Security Concerns: Adding Sensitive Informations in Jira Tickets/Comments

Question

I using Jira (mainly for ticketing) am facing problem while putting sensitive information on tickets tagged with security team, when I am asked to share sensitive information like authentication-policies/ confidential security policies with mates for review and approvals.

I am looking for an options like :-

* Attachment Restrictions – Attachments can have settings option to restrict access per file or provide expiring links.
* Comment Restrictions - Have settings to restrict comment visibility to intended person/s only, rather to whole Project or Board members.
* Built-In Encryption per Item – Comments, text, and attachments can be individually encrypted; instead of they rely only on role/permission-based access.

* One-time Access comments/attachments- which allows me to put short text/file, which remains encrypted, and is intended to be read only once, post that it get's inaccessible.

This will help me to-

* Reduce Risk of Data Leakage – Integrations, notifications, and backups can inadvertently expose sensitive information if SI (sensitive info) are stored directly in Jira.

Looking forwards to reply to address concern. Thank you.

Parth Shah · Answer

Thank you for the suggestion of using third-party vaults or external links. While these tools are certainly more secure for sensitive data, there are a few challenges we face in adopting them:

* Increased Dependencies – Relying on third-party tools adds another layer of dependency and risk if those services face downtime, integration issues, or licensing changes.
* Setup & Configuration Overhead – Many vault solutions require significant setup, maintenance, and ongoing configuration, which may not be feasible for smaller teams or projects.
* Fragmented User Experience – Jumping between Jira and external systems can break workflow continuity, making it harder for teams to collaborate effectively.
* Governance & Compliance Complexity – Adding another tool often brings additional governance and compliance checks, which slows down adoption.

It would have been great, if Jira Tools / Confluence (which is already integrated to surroundings and made compliant in environment) itself offered native secure storage or encrypted fields/attachments, reducing reliance on external tools and simplifying security management.

Varsha Joshi · Answer

Agree with all the items @Matteo Vecchiato highlighted. One suggestion that I could offer is store your doc on sharepoint give point access. Ofcourse with a link in Jira so there is a trail of the communication.

Matteo Vecchiato · Answer

Hi @Parth Shah ,

Welcome to Atlassian community.

My two cents on this topic:

Natively, you can't restrict: attachments per file, comments visibility ( available only in JSM)

There isn't any built-in encryption at work item level, comments and so on.

You can set security only at work item level, through Security levels.

In my opinion, you shouldn't save sensitive data on Jira like passwords and secrets, you should store them in a dedicated software and in Jira adding only a link/reference to them.

I hope it helps